1. Field of the Invention
The present invention relates to establishing and enforcing system policy on a network; and more specifically to systems employing dynamic policy management using active networking devices to establish and enforce system policy.
2. Discussion of the Related Art
The Internet has grown significantly over the past several decades, yet there are signs that applications would benefit from a richer set of Internet services. For example, the expected growth in voice over IP (VoIP) traffic on the Internet will change its overall traffic characteristics. While up to now real-time delivery requirements for IP traffic have been rare, VoIP packets must be delivered within fairly strict time constraints. Since the volume of VoIP traffic is likely to grow into a high percentage of Internet traffic, the services required by the Internet will change. As other real-time traffic, such as that supporting video, becomes prominent, the effect on Internet services will be even more dramatic.
The growth of the Internet and the use of IP based technology has also created a corresponding growth in the number of systems administrators must manage. This scaling problem is being addressed by the use of policy based management systems, whereby administrators specify what should happen and leave it to the policy management system to determine procedures to implement the policy.
The system administrators"" task of administering policy is even further complicated by legacy systems. As networks evolve, older equipment, i.e., legacy systems, remain that may not be able to participate in a particular management policy. Alternately, legacy systems may be able to participate, but the methods required to execute the policy are different, thereby complicating the implementation of the policy. Because of the variety of devices and legacy systems, the complexity of implementing a management policy makes it difficult to establish the policy across all layers and device types of the network, and particularly difficult to maintain such a policy management system even if it could be successfully implemented.
Typically in the prior art a central management station that dispatches instructions to the network devices as needed controls the policy management. The instructions may be very basic, such as telling the device to shut down, or very complex requiring the device. Often the instructions are in response to repetitive processes that are executed periodically, i.e., daily or weekly, or on the occurrence of some event. If system congestion is high or the management system is inoperative, the appropriate action may not be taken, thereby creating system performance degradation; and in the worse case scenario this could lead to system failure.
Accordingly, it is desirable to implement a policy management system which allows for system policy to be executed and maintained at the network device level across layers of network systems and protocols.
Accordingly, the present invention is directed to a dynamic policy management apparatus and method using active network devices that provide for policy enforcement.
The present invention provides a system for providing policy management in a network that includes passive nodes and active nodes operating in multiple protocol layers and having enforcement functions. A variety of network devices, i.e., nodes or active nodes, such as routers, remote access equipment, switches, repeaters, network cards, and end system processes having security functions, are configured to contribute to the implementation of policy enforcement in the network. By distributing policy enforcement functionality to a variety of network devices and end systems, a pervasive policy management system is implemented. The policy management system includes a policy implementation component that accepts policy, i.e., instructions or rules that define how the network device should behave when confronted with a particular situation. The policy enforcement is performed by network devices having tools and resources to execute the active packets distributed throughout the network to enforce the defined policy. The policy being implemented can be implemented across multiple protocol layers and must be coordinated by the policy management system such that particular devices enforce that part of the policy pertinent to their part of the network.
For example, a router in the network enforces that part of the policy that is pertinent to those systems and network devices whose traffic might traverse the router. A switch enforces that part of the policy that is pertinent to those systems and network devices whose traffic traverses the switch. A repeater enforces that part of the policy that is pertinent to those systems and network devices whose traffic traverses the repeater. A network interface card with processing resources (smart NIC) enforces that part of the policy that is pertinent to the system or device to which it is connected. In addition, other parts of the network are included in the policy management hierarchy, such as end system operating systems and applications, remote access equipment, network management systems for controlling network traffic and monitoring network traffic, and other auxiliary systems such as name services file services are included in the collection of network devices that are called upon to enforce a portion of the policy being implemented by the present invention.
To implement the system policy a network manager uses a management station to specify policy for a network. The management station employs a policy definition system, (PDS) supporting a policy definition language (PDL) to create a programming language active packet, which represents at least one rule of the policy, which is then encapsulated in preparation for transmission to the active network devices. The active packet includes, but is not limited to, an object-oriented programming language, such as C++, CAML, JAVA, and Python, having objects and scripting programming language, such as Practical Extraction and Report Language (PERL), Tool Command Language (TCL), or employing shells, e.g. Unix supports Bourne shell, Korn shell, and C-shell code. The active packet is stored in an active packet file on a memory device and the file is optionally signed with a digital signature. The active packet file is either deposited in a network directory, or other distributed database, or sent through the network to the enforcement device and stored in its memory. The enforcement device is signaled when a new policy, represented by the active packet file, or it is available. The signal may contain the active packet or it may inform the device to find the active packet in a network directory or distributed database.
After the enforcement device obtains the active packet file, it is optionally verified via the signature to determine the privileges the active packet should be granted. The active packet file is then extracted from the memory location and the active packet is prepared for execution. The enforcement device checks to see if it has the implementing code (at least one variable, method, and/or data) for the active packet loaded in its memory. If not, the enforcement device obtains the code from a distributed database or directory, or another enforcement device, or similar memory device.
The policy definition language comprises a mobile programming language which in turn includes, but is not limited to, object-oriented and scripting programming languages. If the mobile programming language is an object-oriented language then the active packet comprises an active object, i.e. code plus data, normally referred to just as an object. For each object a thread of execution is established, and the object is executed. The object they uses the services available to it on the enforcement device to enforce the policy or a of the policy. If the mobile programming language is a scripting programming language the active packets comprises active code, normally referred to just as code. The code alone with an interpreter for interpreting the code is transferred to the enforcement device. The code then uses the services available to it on the enforcement device to enforce the policy or a portion of the policy. Several enforcement devices may be utilized to execute a certain policy. Therefore, a particular enforcement device may only enforce a portion of the policy.
The reader should note that the remainder of the disclosure will primarily focus on active packets comprising objects. Those of ordinary skill in the art will appreciate that substantially the same processes and procedures applicable to active objects are applicable to active code. Throughout the disclosure any reference made to an object, unless otherwise stated, refers to an object-oriented object and any reference made to code, unless otherwise stated, refers to a code associated with a scripting programming language.
The management station software provides the system administrator with resources to input a list of rules describing the policy to be enforced on a network. The management station PDS is a software product that creates one or more programming language active packets as previously explained, which represent the rules. The objects, once created, are in a ready-to-run state and are invoked by a thread of execution to implement the processes that they represent. The invocation of the object establishes a thread that can execute independently of other processes running on the various network devices. A process can have several threads running concurrently, each performing different jobs such as waiting for events to occur or performing some other time consuming task. When a thread has finishes its job, the thread is suspended or destroyed and the resources utilized are returned to the system.
After the creation of one or more objects, the management station software will encode the objects into a transportable format. Upon the completion of the encoding, the data identifying the code that the objects need in order to be executed is associated with the encoded transportable objects. After storing the objects to an object file, the management station software will optionally sign the file. The purpose of signing the file is to allow the enforcement device to decide which rights and privileges to grant the objects when they are executed on the enforcement device.
The optionally signed file can either be deposited in a on a storage device, which includes but is not limited to a directory server or distributed database, or sent to the enforcement device via the network. If the file has been deposited in a directory server or distributed database, the management station will either provide the enforcement device with the address to the storage location or the device will know to retrieve the file at a specified location. The notification that an object file is available for the enforcement device can occur in many ways including, but not limited to, the changing of a state or variable that the enforcement device monitors.
If the enforcement device receives a signal indicating that a new policy, represented by the object file, is available for it on a directory server or distributed database, it will retrieve the object file. Upon retrieval or receipt of the object file, the enforcement device will extract the object file contents.
The enforcement device will optionally verify the signature of the object file, as previously stated, to determine which of its base services that it will allocate to the objects in the signed file to utilize in the implementation of its proscribed functions. The enforcement device will then examine the data within the file which specifies the code required by the objects. If it does not have the code stored in its memory, it will extract the code or a reference to the code from the file. If the code is in the enforcement device""s memory it is then loaded into its program memory and executed. Otherwise, the device uses the reference to retrieve the code from a directory server or distributed database.
The present invention provides distinct advantages over the prior art, in that traditionally, policy is represented as flat data, requiring an enforcement device to understand its syntax. If this syntax changes, either to add new kinds of policy terms or to restructure the representation, all enforcement devices must be reprogrammed to parse the new syntax.
With the present invention, the contract between the network device and network management system involves only the methods that a policy object exports. Thus, new methods can be added to an object class that control new aspects of policy without affecting legacy enforcement devices. Also, the internal representation of policy may change without affecting either the network management station or the enforcement device.
The present invention further supports a process called co-location, which enables the objects to be distributed with their code, or references to their code that implements the policy, throughout the network. Co-location enables new policy implementations to be distributed to devices without changing the underlying base implementations of the devices. For instance, legacy systems would have to be re-booted in order for new policy implementations to be enabled. Co-location permits the legacy systems to continue their base functions undisturbed while a new policy is implementation is distributed to the enforcement devices.
Another advantage of the present invention is the separation of policy rule enforcement, which is accomplished by creating an independent thread for each object representing a particular rule. Network administrators can independently stop or start the enforcement of each rule in the policy specification without affecting-the enforcement of other polices in the specification.
Additional features and advantages of the invention will be set forth in the detailed description which follows, and in part will be apparent from the description, or may be learned by practice of the invention. The aspects and other advantages of the invention will be realized and attained by the structure particularly pointed out in the written description and claims hereof as well as the appended drawings.
To achieve these and other advantages and in accordance with the purpose of the present invention, as embodied and broadly described, the present invention can be characterized according to one aspect as a system providing dynamic policy management in a network, including a management station coupled to said network, the management station: including resources to store data defining policy rules for a device in the network. Resources in the management station are included for producing an active packet including at least a variable and a method, in response to the data defining the policy rule, the active packet having a format. Resources in the management station are included for sending the active packet to the network device adapted to read and execute the active packet according to the format.
Another aspect of the present invention can be characterized as a system for dynamic policy management in a network, including a network device coupled to said network, the network device including resources to receive an active packet representing a policy rule from a second device in the network, the active packet having a format; resources in the network device for decoding the active packet according to the format, the active packet including a variable and a method; and resources in the network device for executing the active packet.
A further aspect of the present invention can be characterized as a system for dynamic policy management in a network including a management station and a network device coupled to said network, wherein the management station includes:
1) resources to store data defining a policy rule for a device coupled to the network;
2) resources in the management station for producing an active packet including a variable and a method in response to the data defining the policy rule, the active packet having a format; and
3) resources in the management station for sending the active packet to the network device, wherein the network device includes resources to receive, decode, and execute the active packet according to the format.
A still further aspect of the present invention can be characterized as a system providing dynamic policy management by a method, the system, including an interface adapted to receive instructions characterizing policy regarding control of a network; and an active node connected to the interface which provides a packet to the network, the packet including one of a variable and a method and a reference to the variable and the method, executable on the network to set up a process to enforce at least a portion of the policy.
Another aspect of the present invention can be characterized as a system for dynamic policy management in a network, including a network node adapted to receive a packet, created by a first process, representing policy for control of a network; and resources in the network node capable of executing a packet including one of a variable and a method and instructions to locate the variable and the method, executable on the network node to enforce a portion of the policy.
An additional aspect of the present invention can be characterized as a system for dynamic policy management in a network, including an active node and a network node coupled to said network, wherein the active node includes:
A) resources to store data defining a policy rule for a device coupled to the network;
B) resources in the active node for producing a packet including a variable and a method in response to the data defining the policy rule; and
C) resources in the active node for sending a packet file containing one of the packet and a reference to the packet to the network node, wherein the network node includes resources to receive, decode, and execute the packet.
It is to be understood that both the foregoing general description and the following detailed description are exemplary and explanatory and are intended to provide further explanation of the invention as claimed.